Skip to content
KitploitKITPLOIT
HerramientasBlog
Enviar
HerramientasBlog
Enviar

¡Herramientas de Hacking, PenTest y Ciberseguridad para tu Arsenal de Seguridad!

Kitploit es un directorio de herramientas de hacking, ciberseguridad y pentesting. Descubre las últimas actualizaciones de proyectos para encontrar vulnerabilidades, analizar sistemas, automatizar pruebas y fortalecer tu seguridad.

··Feeds·Contacto·Privacidad·© 2026 Kitploit

Directorio de Herramientas

Categorías

Ver todas las categorías
Loading categories
My-Exploits — Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474). | Kitploit
Herramientas/GitHubGitHub/m4xsec/my-exploits
Container SecurityExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud SecurityLearning & EducationPayload DevelopmentLabs & Practice
GitHubm4xsec/my-exploits
111hace 19 díasAún no revisado

Más Populares

Ver todos →

Descubre las herramientas más usadas por nuestra comunidad.

Explora todas las herramientas

Explora nuestra colección de herramientas

Ver todas las herramientas →
Compartir

My-Exploits

Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).

Ver Repositorio
Contenido no disponible en el idioma solicitado. Mostrando versión en inglés.

My-Exploits

Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of concept, and a small Docker lab that stands up only the vulnerable service so anyone can reproduce the bug without taking my word for it.

Nothing here targets a live environment. The labs are throwaway containers on your own host.

Findings

CVEComponentClassAffectedMetasploitPoCLab
CVE-2026-18963KeycloakReset-credentials sticky-selector account takeover< 26.7.2yesyesyes
CVE-2026-39816Apache NiFiTinkerpop / ExecuteGraphQuery Groovy RCE past the execute-code gate2.0.0-M1 .. 2.8.0yesyesyes
CVE-2026-5006HashiCorp VaultTemplated-policy metadata slash injection (HCSEC-2026-32)<= 2.0.3yesyesyes
CVE-2026-7474HashiCorp NomadDynamic host-volume plugin_id path traversal to root (HCSEC-2026-15)<= 2.0.0yesyes

Layout

root@kitploit:~
metasploit-custom-modules/   Metasploit modules + module docs, in the normal framework tree
exploits/                    one self-contained Python PoC per CVE
docker-lab/                  one throwaway Docker lab per CVE, spins up only the vulnerable service

Each of those three has its own README with the details. Short version:

  • metasploit-custom-modules/ drops straight into a framework checkout (or your ~/.msf4). Three modules: the Keycloak takeover, the Vault metadata slash injection, and the NiFi RCE.
  • exploits/ is four dependency-light Python scripts, one per CVE. They run against the matching lab with no edits.
  • docker-lab/ is four independent labs. Each pins the last vulnerable release, wires up whatever the bug actually needs (the graph bundle for NiFi, a real Docker engine for Nomad), and nothing more. No flags, no chained scenario, just the bug.

Reproducing a finding

Pick a CVE, bring its lab up, fire the PoC. For example, Keycloak:

root@kitploit:~
cd docker-lab/keycloak-cve-2026-18963
docker compose up -d
cd ../..
python3 exploits/kc_ato_18963.py \
    --base http://127.0.0.1:8080 --realm larkspur \
    --victim j.okonkwo --newpass Chang3d-by-attacker!

The other three follow the same pattern. Read the per-lab README first, a couple of them need --build and a minute to provision.

Disclosure

All four were reported to the respective vendors and are fixed in the versions noted above. Everything published here runs against the deliberately outdated images in docker-lab/. Point it at anything you do not own and that is on you.

License

MIT. See LICENSE.

Descargar herramienta